CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
Overview
FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager contain a path traversal flaw in their CLI command handlers that fails to restrict file-path arguments to a safe base directory. An authenticated administrator with read-write permissions can supply traversal sequences in specific CLI commands to write or delete arbitrary files anywhere on the device filesystem. Affected versions span multiple release lines across all four products, with fixed boundaries in FortiOS 7.4.10 and 7.6.5, FortiProxy 7.4.12 and 7.6.5, FortiSwitchManager 7.0.7 and 7.2.8, and later FortiPAM releases.
Vulnerability details
Path traversal vulnerabilities (CWE-22) occur when an application accepts a user-supplied file path and passes it to a filesystem operation without first normalizing and validating it against an allowed base directory. In these Fortinet products, specific CLI commands accept pathname arguments that the command handler does not restrict to an intended directory. An attacker who supplies sequences such as directory traversal strings can cause the handler to resolve a path outside the intended working directory, reaching arbitrary locations on the device filesystem. The flaw is in input validation at the CLI layer, not in the underlying OS.
An attacker who has authenticated to the device with an admin profile and at least read-write permissions can issue crafted CLI commands containing traversal sequences to write files to or delete files from arbitrary filesystem locations. This access could be used to overwrite configuration files to persist unauthorized changes, disable security controls, or delete critical system files to cause a denial of service. CLI access may be obtained via SSH over the network or through a local console session, so the attack is reachable remotely where SSH management is exposed.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review CLI audit logs for commands containing path traversal patterns (sequences of repeated directory separators or dot-dot segments) in file-path arguments, particularly from admin accounts that do not normally issue file-manipulation commands.
- Monitor filesystem integrity on affected devices for unexpected modifications or deletions outside normal configuration paths, especially in directories unrelated to routine administrative activity.
Remediation
Additional hardening
- Upgrade FortiOS to 7.4.10 or 7.6.5 and FortiProxy to 7.4.12 or 7.6.5; upgrade FortiSwitchManager to 7.0.7 or 7.2.8. For FortiPAM and remaining products, consult the vendor advisory in References for the applicable fixed release.
- Restrict CLI access (SSH and console) to dedicated management networks or jump hosts, and block direct SSH access to management interfaces from untrusted networks or the internet.
- Apply the principle of least privilege to admin accounts: limit read-write admin profiles to personnel who require them, and audit existing accounts for over-provisioned permissions that satisfy the preconditions for this flaw.
- Enable centralized logging of all CLI sessions to an external syslog or SIEM so that file-manipulation commands are captured and reviewable independent of the device itself.
Key dates
References
- https://fortiguard.fortinet.com/psirt/FG-IR-26-122
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2025-61624
- https://cert-portal.siemens.com/productcert/html/ssa-975644.html
- https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/#post-188095-_guyq53ar8k05
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624
Frequently asked questions
Does CVE-2025-61624 affect my FedRAMP authorization?
If Fortinet Multiple Products runs inside your authorization boundary, yes. CVE-2025-61624 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of October 19, 2026. For a FedRAMP-authorized service, an unpatched KEV within the boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it during review.
How does Knox help me handle CVE-2025-61624?
Knox does not patch your Fortinet Multiple Products deployment. Under the FedRAMP shared-responsibility model, that remediation belongs to you. What Knox provides is the pre-authorized, single-tenant boundary to carry out that work in, along with Knox's automated continuous monitoring platform and audit-artifact coverage to document the fix for your next assessment. The work of applying the patch is yours; managing compliance posture while you do it is not something you handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2025-61624. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you earlier visibility and more time to act.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2025-61624 isn't remediated by October 19, 2026?
An unremediated CVE-2025-61624 becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the item out and documenting the remediation is what keeps your authorization clean and the agency relationship intact.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
